Another Excel Flaw Found, Exploit Code Released

Microsoft's security response team confirms the existence of a second unpatched Excel vulnerability that carries a "highly critical" rating.

Officials at the Microsoft Security Response Center are scrambling to investigate a second zero-day flaw in the Excel spreadsheet program, after a private researcher released exploit code to prove the extent of the vulnerability.
A company spokesperson confirmed to eWEEK that the new vulnerability could be exploited if a user is tricked into clicking on a hyperlink in Microsoft Office documents.
"Microsoft is not aware of any attacks based on this code or of customer impact at this time," the spokesperson added.

Proof-of-concept code has been released on the Milw0rm site. Secunia, a security information aggregator based in Copenhagen, Denmark, rates the latest bug as "highly critical" and warned that successful exploitation will allow the execution of arbitrary code.

The company warned that the latest vulnerability "is quite simple to exploit" and urged Microsoft customers to avoid opening or following links in untrusted Office documents.
"It is likely that exploit code [will be] published soon," the company warned.
The publication of a new Excel bug could not have come at a worse time for the Redmond, Wash., software maker. Microsoft is currently working on a patch for a code execution hole in Excel that has already been used in a highly targeted zero-day attack.
Microsoft has published an advisory with pre-patch workarounds to help businesses avoid potential attack
Check out eWEEK.coms for the latest security news, reviews and analysis. And for insights on security coverage around the Web, take a look at eWEEK.com Security Center Editor Larry Seltzers Weblog.